Privacy Policy

This policy applies to all users of Prudora — including students under 18 and their parents or guardians. Prudora is a personalised study coach for IB Mathematics. We take the privacy of young people especially seriously and have designed our data practices accordingly.

We do not collect sensitive categories of data (Art. 9 GDPR), payment card details, or any location data. We do not use your data for advertising or sell it to third parties.

Prudora is designed for students aged 16–18 preparing for IB examinations. We gate registration behind an age confirmation step:

• Age 16 and over: you agree to this policy yourself during onboarding.
• Under 16: a parent or guardian must read and accept this policy on your behalf before the account is activated. By ticking the consent checkbox, the parent/guardian confirms this.

We record the time consent is given. Parents and guardians may withdraw consent at any time by contacting us or by using the account deletion feature in the student's profile. Withdrawal of consent will result in deletion of all data.

When you use the AI Tutor feature, your messages and the question context are sent to Anthropic, Inc. (USA) for processing. Anthropic does not use your data to train their models by default. See Anthropic's privacy policy. A Data Processing Agreement (DPA) is in place between Prudora and Anthropic.

Retention: AI conversation history is automatically deleted after 90 days.

We use the following sub-processors, each bound by a DPA:

SCCs = EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), used where processors are based outside the EEA.

• Account and practice data: kept for as long as your account is active. Deleted immediately and permanently when you delete your account.
• AI Tutor conversations: automatically deleted after 90 days from the last message.
• Email logs (Resend): retained for up to 30 days by Resend for delivery debugging.
• Consent record: kept for 5 years after account deletion, as required for legal accountability under Art. 7(1) GDPR.

Under GDPR you have the right to:

• Access (Art. 15): download everything we hold about you. Profile → Export my data.
• Rectification (Art. 16): correct your name, grade target or exam date from Profile settings.
• Erasure (Art. 17): permanently delete your account and all associated data. Profile → Delete my account.
• Restriction (Art. 18) / Objection (Art. 21): contact us directly at tutoring.irina@gmail.com.
• Portability (Art. 20): the data export is machine-readable JSON covering all tables.
• Complaint: you have the right to lodge a complaint with your national supervisory authority. In Portugal: CNPD (cnpd.pt).

We will respond to all rights requests within 30 days (Art. 12(3) GDPR).

Data is encrypted in transit (TLS 1.2+) and at rest. Access to the database is restricted to authenticated users via Row Level Security (RLS) policies — your data is only accessible to you and your assigned teacher. We apply Content-Security-Policy, HSTS, and other defence-in-depth headers.

To report a security vulnerability: security.txt.

Prudora uses a single session cookie set by Supabase Auth (name: sb-<project>-auth-token). This is a strictly necessary cookie — it is required for you to be logged in. We do not use advertising or analytics cookies. A small amount of data (haptic feedback preference, theme) is stored in localStorage on your device and never transmitted to our servers.

We will notify you of material changes by email or via an in-app banner at least 14 days before the change takes effect. The “Last updated” date at the top of this page shows when it was last revised.

For any privacy question, rights request, or concern: tutoring.irina@gmail.com. We aim to respond within 3 business days.